Authentication

Verify Telegram Login Widget data on the server.

Authentication uses the Telegram Login Widget. The server validates hash with TELEGRAM_BOT_TOKEN.

Verification endpoint

POST /api/auth/telegram
Content-Type: application/json

The payload includes id, first_name, optional username, auth_date and hash. Data older than 24 hours is rejected.

Authentication errors

• 503 telegram_not_configured — bot token is missing.
• 401 telegram_auth_expired — payload is too old.
• 401 telegram_auth_invalid — signature does not match.